CVE-2026-29797

Katalog CVE

CVSS 7.1 · High EPSS 0,16%

Kerentanan Download of Code Without Integrity Check. Skor CVSS 3.1 7.1 (High) menurut hq.dhs.gov.

Deskripsi (NVD)

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.

Rincian

Terbit di NVD

9 Oktober 2026

Terakhir diubah

11 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.1 (High), sumber hq.dhs.gov
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-494: Download of Code Without Integrity Check

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01
• https://www.hms-networks.com/
• https://www.hms-networks.com/cybersecurity